ci(6dq): add G2 security scanning

[nocoo]

6DQ G2 Security Scanning Compliance

Adds G2 (security scanning) to meet 6DQ quality standard:

Changes

• .gitleaks.toml — Secret detection configuration with test file allowlist
• osv-scanner.toml — Dependency vulnerability scanner configuration
• Pre-commit hook — Added gitleaks protect --staged (G2a) + typecheck if missing
• Pre-push hook — Added osv-scanner scan (G2b)

6DQ Standard Reference

• G2a (Secrets): gitleaks in pre-commit — zero tolerance for leaked secrets
• G2b (Dependencies): osv-scanner in pre-push — scan lockfile for known CVEs
• Benchmark: Zhe project (Tier S standard)